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Abstract 

We introduce constructive and classical systems for nonstandard arithmetic and 
show how variants of the functional interpretations due to Godel and Shoenfield 
can be used to rewrite proofs performed in these systems into standard ones. These 
functional interpretations show in particular that our nonstandard systems are con- 
servative extensions of E-HA" and E-PA'^, strengthening earlier results by Moerdijk 
and Palmgren, and Avigad and Helzner. We will also indicate how our rewriting 
algorithm can be used for term extraction purposes. To conclude the paper, we will 
point out some open problems and directions for future research, including some 
initial results on saturation principles. 
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1 Introduction 

In this paper we present functional interpretations for both constructive and classical 
systems of nonstandard arithmetic. The interpretations have two aspects: they show 
that the nonstandard systems are conservative over ordinary (standard) ones and they 
show how terms can be extracted from nonstandard proofs. 

After inventing nonstandard analysis and showing that it was a versatile idea leading 
to nonstandard proofs in various areas of mathematics, Robinson suggested one could 
look at nonstandard arguments "syntactically" (proof-theoretically). From this point 
of view, one would see nonstandard analysis as "introduc[ing] new deductive procedures 
rather than new mathematical entities" |43) . Apparently he did not think that adding 
these new deductive procedures to standard systems would make them more powerful 
or stronger in a proof-theoretic sense. In fact, in [52] he formulates as a general problem 
"to devise a purely syntactic transformation which correlates standard and nonstandard 
proofs of the same theorems in a large area, e.g., complex function theory^\ In [30j he is 
reported as asking a more specific question, whether a certain system for nonstandard 
arithmetic is conservative over PA. These ideas of Robinson have borne fruit in the 
work of Kreisel [301131], Friedman (unpublished). Nelson [35] [33], Moerdijk, Palmgren 
[33133111], Avigad [5] [5] and others, who proved for various systems for nonstandard 
analysis that they are conservative extensions of standard systems. Often their argu- 
ments are effective in that one could extract algorithms from their proofs which convert 
nonstandard arguments into standard ones. 

As an example of this, let us have a short look at the work of Nelson, also because 
it is a major source of inspiration for this article. The idea of Nelson was to add a new 
unary predicate symbol st to ZFC for "being standard". In addition, he added three 
new axioms to ZFC governing the use of this new unary predicate, called Idealization, 
Standardization and Transfer. The resulting system he called 1ST, which stands for 
Internal Set Theory. The main logical result about 1ST is that it is a conservative 
extension of ZFC, so any theorem provable in 1ST which does not involve the st-predicate 
is provable in ZFC as well. Hence such theorems are genuine mathematical results, 
acceptable from the generally shared foundational standpoint of ZFC. 

The conservativity of 1ST over ZFC was proved twice. In the original paper where 
he introduces Internal Set Theory [33 (recently reprinted with a foreword by G. F. 
Lawler in Volume 48, Number 4 of the Bulletin of the American Mathematical Society 
in recognition of its status as a classic). Nelson gives a model-theoretic argument which 
he attributes to Powell. In a later publication [39], he proves the same result syntacti- 
cally by providing a "reduction algorithm" (a rewriting algorithm) for converting proofs 
performed in 1ST to ordinary ZFC-proofs. There is a remarkable similarity between 
his reduction algorithm and the Shoenficld interpretation j45j ; this observation was the 
starting point for this paper. 

We will work with systems in higher types, such as HA" and PA", rather than set 
theory, because, as we mentioned before, we will not just be interested in establishing 
conservation results, but also in extracting terms from nonstandard proofs and "proof 
mining" . Proof mining is an area of applied logic in which one uses proof-theoretic 
techniques to extract quantitivc information (such as bounds on the growth rate of 
certain functions) from proofs in ordinary mathematics. In addition, such techniques 
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can reveal certain uniformities leading to new qualitative results as well. Functional 
interpretations are one of the main tools in proof mining (for an introduction to this part 
of applied proof theory, see |25j). To extract interesting bounds, however, it is important 
that the mathematical arguments one analyses can be performed in sufficiently weak 
systems: therefore one considers systems such as HA'^ or PA"^, or fragments thereof, 
rather than ZFC. The reason for considering systems in higher types (rather than PA, 
for instance) is not just because they are more expressive, but also because higher types 
are precisely what makes functional interpretations work. 

Although establishing conservation and term extraction results for systems of non- 
standard arithmetic is what this paper is about, there is another way of looking at the 
results of this paper, which has more to do with the ideas of Lifschitz on calculable 
numbers |35j , of Bcrgcr on uniform Hcyting arithmetic [7] and of Hernest on the light 
Dialectica interpretation [TH], than with nonstandard arithmetic. Their idea was to 
have two kinds of quantifiers, one with computational content and one without. On the 
realizability interpretation of Lifschitz, the computationally meaningful quantifiers are 
interpreted in the usual way (which, in the case of the existential quantifier, means that 
a realizer needs to exhibit a witness, while a realizer for a universal statement Vn '^{n) 
is a program which computes a realizer of '^{n) from the value n). The computationally 
empty quantifiers, on the other hand, arc to be interpreted uniformly (which means that 
it need not exhibit a witness in the existential case: a witness simply has to exist; while 
in the case of the universal quantifier it has to be a realizer which, uniformly, realizes 
(p(n) for all n). 

A new unary predicate st introduces two types of quantifiers as well: the internal 
quantifiers Vx and 3a;, as well as the external quantifiers V^*a: and 3^^x (which can be 
seen as abbreviations of Vx ( st(a;) —?>...) and 3x ( st(x) A . . .) respectively). Our initial 
idea was to interpret the former uniformly, while interpreting the latter in the usual 
way, in complete analogy with the ideas of Lifschitz. But this led to several, to us, 
undesirable effects (in particular, one could not realize the statement that the standard 
natural numbers are closed downwards) . Our solution was to weaken the computational 
meaning of the external quantifiers: in particular, to realize 3^^n Lpin) it suffices to exhibit 
a finite lists of candidates ni, . . . , n^. such that at least one of the statements ip{ni) is 
realized. Because of the analogy with Hcrbrand disjunctions from proof theory, we have 
dubbed this type of realizability "Hcrbrand realizability" . 

To make Herbrand realizability work in a higher type setting, it is convenient to 
work in an extension of HA'^ with types for finite sequences. More precisely, we will 
assume that there is a type a* for sequences of objects of type a. The type a* carries 
the structure of a preorder (with x ^ y ii every element in the list coded by x also occurs 
in the list coded by y) and one would naturally expect realizers to be closed upwards 
with respect to this preorder. To make this work nicely, it will be useful to introduce 
a new kind of application (of functions to arguments) which is monotone in the first 
component. This can be done and with this additional ingredient Herbrand realizability 
can be defined. We will do this in Section 4. 

It has to be admitted that the connection of Hcrbrand realizability to nonstandard 
arithmetic is rather tangential and, as a matter of fact, wc will not be very interested 
in Herbrand realizability per se. This will change radically if we turn to the functional 
interpretation introduced in Section 5, which bears the same relation to Hcrbrand real- 
izability as the usual Dialectica interpretation does to modified realizability It turns out 
that if one defines a Dialectica-type functional interpretation using the new application, 
with implication interpreted d la Diller-Nahm [5] , basing it on some of the characteristic 
principles of Herbrand realizability, and the idea of having Herbrand disjunctions realize 
existential statements, this interpretation will, almost by magic, interpret and eliminate 
principles recognizable from nonstandard analysis. Our main reason for including Her- 
brand realizability is to have an easy point of access to and to provide some intuition 
for this functional interpretation. 

So far the techniques wc mentioned work only for constructive systems. But by 
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combining the functional interpretation we mentioned above with negative translation, 
we are able to define a Shoenfield-type functional interpretation for classical nonstandard 
systems as well. In this way we also obtain conservation and term extraction results for 
classical systems. We will work out the technical details in Sections 6 and 7 below. 

The resulting functional interpretations have some striking similarities with the 
bounded functional interpretations introduced by Ferreira and Oliva in |12j and |10) 
(see also [13] )• In the same way, Herbrand realizability seems related to the bounded 
modified realizability interpretation due to Ferreira and Nunes (for which, see [H]). We 
will briefly comment on this in Section 5 below. 

The contents of this paper are therefore as follows. In Section 2 we will introduce 
an intuitionistic base system for our investigations into constructive nonstandard arith- 
metic. In Section 3, we will discuss some principles from nonstandard analysis and 
their relations. This will give one some ideas of how interpretations of nonstandard 
systems have to look like and will provide us with some "benchmarks" with which one 
can measure the success of an interpretation. In Section 4 we will introduce Herbrand 
realizability and discuss its merits as an interpretation of nonstandard arithmetic. Our 
nonstandard functional interpretation will be introduced in Section 5 and we will use it 
to prove several conservation and term extraction results in an intuitionistic context. In 
Section 6 we introduce a classical base system for nonstandard arithmetic and discuss 
two variants of the negative translation. These we will use in Section 7 to obtain a 
Shoenfield-type functional interpretation and derive conservation and term extraction 
results in a classical context. Finally, Section 8 discusses work in progress on saturation 
principles and other plans for future work. 

We would like to thank Paulo Oliva, the participants in the Spring 2010 proof theory 
seminar at the Technische Universitat Darmstadt, especially Ulrich Kohlenbach, Jaime 
Caspar, and Alexander Kreuzer, and the referee for helpful comments. 

2 Formalities 

In this section, we introduce our base systems for investigating nonstandard arithmetic. 
2.1 The system E-HA"'* 

In this paper, E-HA'^* will be the extension of the system called E-HAq in [48] and 
E-HA^^ in [33 with types for finite sequences. More precisely, the collection of types 2* 
will be smallest set closed under the following rules: 

(i) e T; 

(ii) a,T e T- ^ {a ^t) e T*; 

(iii) ae T ^a* e T*. 

Because we have not included product types in T*, we will often be handling tuples 
of types or terms. We will always refer to such lists of types and terms as tuples and 
never as sequences, so as not to confuse them with terms of sequence type (i.e., of type 
a* for some a S T*). In dealing with tuples, we will follow the notation and conventions 
of j48j and [25]. In particular, if x = xq, . . . , Xm-i and y ^ i/q, . . . , Un-i, then 

1. [] stands for the empty tuple, while x, y stands for xq, ■ ■ ■ , Xm-i, 2/Oj • ■ • j Un-i] 

2. Xiy stands for (. . . {{xiyo)yi) . . .)y„-i, while xy stands for xoy, . . . ,Xm-iy (and 
never for xq, . . .,Xm-iy); 

3. Xx.y stands for Ax.yo, • ■ • , Xx-Un-i, 



4 



4. and, finally, if ^ = Xq" , . . . , x'^_^ and y = y'^° , . . . , y'^Z^i are tuples having the 
same length and types, we will write x_ =„ y for 

m — 1 

Because we have included sequence types, we will have to enrich the term language 
(Godel's 7~); it now also includes a constant {)a of type a* and an operation c of type 
a — > (cr* — > cr*) (for the empty sequence and the operation of prepending an element to 
a sequence, respectively), as well as a list recursor i^p satisfying the following axioms: 

La.p O^yz =p y, 

L^pc{a,x)yz =p z{L^pXyz)a, 

where p = pi, . . . , pk is a fc-tuple of types, y — yi, . . . ,yk is a fc-tuplc of terms with yi of 
type Pi and z = zi , . . . , is a fc-tuple of terms with Zi of type pi —>...—)■ p/t —> (T 
(compare |49l p. 456] or |25l p. 48]). In addition, we have the rccursors and combinators 
for all the new types in Godel's 7", satisfying the usual equations. The resulting extension 
we will denote by T*. 

We will have a primitive notion of equality at every type and equality axioms ex- 
pressing that equality is a congruence (as in [JHl P- 448-9]). Since decidability of 
quantifier-free formulas is not essential for this paper, this choice will not create any 
difficulties. In addition, we assume the axiom of cxtcnsionality for functions: 

/ =cr^r 9 ^ V.T°" fx QX. 

Of course, the underlying logic of E-HA"* is constructive; we will assume it is ax- 
iomatized as in [551 P- 42]. Wc also have all the usual axioms of E-HA", as in pSl 
p. 48-9], for example, where it is to be understood that the induction axiom applies to 
all formulas in the language (i.e., also those containing variables of sequence type and 
the new terms that belong to 7"*). Finally, we add the following sequence axiom: 

SA : Vy'^* ( 2/ = (). V 3a^ .t^* y = c(a, x) ). 

In normal E-HA", as in [2S] or [32], for example, one can also talk about sequences, 
but these have to be coded up (see [25l p. 59]). As a result, E-HA"* is a definitional 
extension of, and hence conservative over, E-HA'^ as defined in [55] or |49) . 

2.2 The system E-HA^,* 

Definition 2.1. The language of the system E-HA^j* is obtained by extending that of 
E-HA"^* with unary predicates sf^ as well as two new quantifiers V'.t'^ and 3^^x'' for 
every type a G T*. Formulas in the language of E-HA'^* (i.e., those that do not contain 
the new predicate stg. or the two new quantifiers V^'a;'^ and 3*''a;'^) will be called internal. 
Formulas which arc not internal will be called external. 

We will adopt the following 

Important convention: We follow Nelson [35] in using small Greek 
letters to denote internal formulas and capital Greek letters to denote for- 
mulas which can be external. 

Definition 2.2 (E-HA^^*). The system E-HA^^* is obtained by adding to E-HA"'* the 
axioms EQ,7^j and lA**' , where 
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• EQ stands for the defining axioms of the external quantifiers: 

V'V o V.T ( st(.T) -> ), 

3*^*0; <I>(.t) o 3.T (st(.T) a $(a;) ), 

with $(2;) an arbitrary formula, possibly with additional free variables. 

• Tsl consists of: 

1. the axioms st(a:;) A x = y — > st(y), 

2. the axiom st{t) for each closed term t in T*, 

3. the axioms st(/) A st(a-) — > st(/a;). 

• lA*^* is the external induction axiom: 

lA"' : ($(0) A V''n°($(7i) ^ $(71 + 1))) ^ V'*7i"$(n), 

where $(77,) is an arbitrary formula, possibly with additional free variables. 

Here it is to be understood that in E-HA^^* the laws of intuitionistic logic apply to all 
formulas, while the induction axiom from E-HA'^* 

(V?(0) A V77''(v3(7i) ^ 95(71 + 1))) ^ \fn°ip{n) 

applies to internal formulas ip only. 

Lemma 2.3. E-HA^j*h $(a;) Ax — y ^ ^{y) for every formula $. 

Proof. By induction on the logical structure of $. Note that the st-predicate is exten- 
sional by 7^^ and the case of the external quantifiers V*'* and 3**' can be reduced to that 
of the internal quantifiers V and 3 by using the EQ-axiom. □ 

Lemma 2.4. E-HA^^* h st°(a;) Ay<x^ st°{y). 

Proof. Apply external induction to the formula := Vy (y < x — > st{y)). □ 

Remark 2.5. The previous lemma implies that, whenever n is a standard natural num- 
ber, a bounded internal quantifier of the form 3*^*7 < n can always be replaced by 37 < 77 
and vice versa (the same applies to the universal quantifiers, of course). So we can re- 
gard such bounded quantifiers as internal or external, depending on what suits us best. 
Most often, however, it will be convenient to regard them as internal quantifiers. 

Definition 2.6. For any formula $ in the language of E-HA"^* we define its internal- 
ization to be the formula one obtains from $ by replacing st(a;) hy x = x, and 
and 3*'*x by \fx and 3x, respectively. 

One of the reasons E-HA^^* is such a convenient system for our proof-theoretic inves- 
tigations is because we have the following easy result: 

Proposition 2.7. // a formula $ is provable in E-HA"j* then its internalization is 
provable in E-HA"*. Hence E-HA"j* is a conservative extension of E-HA"* and E-HA". 

Proof. Clear, because the internalizations of the axioms of E-HA^^.* are provable in 
E-HA"*. □ 
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2.3 Operations on finite sequences 

Using the list recursor L„^p one can define a length function | • | : ct* — > satisfying 

|c(a,.T)| = 5|a;|. 

Moreover, we can fix for every type a a term Oa in T* of that type. One can then also 
define a projection function cr* — > (0 — > cr); we will write {x)i for the zth projection of 
X. It satisfies: 

(().)n = a, 

{c{a,x))o = a, 

{c{a,x))sn = ix)n- 

In addition, we will have an operation which given xq, ■ ■ ■ ,Xn-i of type a builds an 
object X = {xq, . . . , x„_i) of type a* for which we have |x| — n and 

(x)i — Xi if i < |a;|, 
{x)i — Oa otherwise. 

We will also need a concatenation operation : ct* — > (ct* — > ct*) defined by: 

{)a *a' y = y, 
c{a,x)*a'y = c{a,x*y). 

This we can use to define an n-fold concatenation: If : — > ct* and n is of type 0, 
then we can set: 



0, ifn = 0, 

{F{0) . . . F{n - 2)) F{n - 1) if n > 0. 



Note that F(0) . . . *a- F{n - 1) = F(0) if n = 1. 
Lemma 2.8. 1. E-HA^^* h st(x'"' ) ^ st(|a;|), 

2. E-HA^t*h st(x'^') ^ st((a;),), 

3. E-HA^;h st(xEl) A ... A st«) ^ st((.Tj, . . . 
I E-HA^t*h st(x'"') Ast(2/'"*) ^ st(.T y). 

5. E-HA^t*h st(F"^'"*) Ast(nO) ^ st(i^(0) * . . . * F(n - 1)). 

Proof. Follows from the T^^-axioms together with the fact that the list recursor L 
belongs to T* . □ 

Notation 2.9. 1. Given x — Xq°, . . . , a;^^Y ^^^^ i ~ *oi • ■ • ' *m-i '^^ "^il^ write \x\ 
for \x^° I , . . . , IxJ'^^Y I and (x), for (x^" (a;^„''lY . 

2. Given x = Xq° , . . . , xJ^Y ^-i^^ ~ l/o ^m"^/ > '^'^ '^i^l write (x) for 

{xq"), (a;^"ri'), and (x,^) for (xo,yo), • ■ • , (x,„„i, 

3. Given x = Xq" , . . . , xJ^"lY and y = i/q° , . . . , y'^Si , we will write x y for 

xo *a-5 yo, • ■ • , a^m-i ym-i- 
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2.4 Finite sets 

Most of the time, we will regard finite sequences as stand-ins for finite sets. In fact, we 
will need the notion of an element and that of one sequence being contained in another, 
as given in the definitions below. 

Definition 2.10. For s'^,t°' we write s Ga t and say that s is an element of t if 

For s— = Sq°, . . . , s^^"j^ and t— — t^" , . . . , t^'l^i we write s Ga t and say that s is an 
element of t if 

n-1 
k=0 

In case no confusion can arise, we will drop the subscript and write simply € instead of 
Go- or Gcr*. 

Lemma 2.11. E-HA^^* h st(a:;'^* ) Ay Ga x ^ stiy"). 

Proof. Follows from Lemma [2.81 2 and the extensionality of the st-predicatc (first part 
of the Tsl- 'Axiom). □ 

Definition 2.12. For s°' we write s t and say that s is contained in t if 

Mx"^ {x e s ^ X e t), 

or, equivalently, 

V^ < \s\3j < \t\{s), {t)j. 

For s— ~ Sq° , ■ . ■ , and t— = ip" , . . . , i^'l^^ we write s t and say that s is 

contained in t if 



l\ Sk dlak tk- 



k=0 

Lemma 2.13. E-HA"^* proves that determines a ^reorder on the set of objects of 
type a* . More precisely, for all x"^ we have x x, and for all x"^ ,y'^ , z'^ with x y 
and y -<„ z, we have x :<„ z. 

Proof. Obvious. □ 

In relation to this ordering the notion of a property being upwards closed in a variable 
X will be of importance. 

Definition 2.14. A property ) is called upwards closed in x if ^{x)Ax ^ y — 5- ^{y) 

and downwards closed in x if ^{x) A y ^ x — > $(2/). 

2.5 Induction and extensionality for sequences 

The aim of this subsection is to prove induction and extensionality principles for se- 
quences. It all relies on the following lemma: 

Lemma 2.15. 1. E-HA"* h Vx'^' {\x\ ^ ^ x ^ Q^). 

2. E-HA"* h VnO, x''' ( = o 3a, y"' [x = c{a, y)A\y\=n)). 

Proof. The right-to- left directions hold by definition of the length function | • |. So 
suppose we have an element x of type a*. Then, by the sequence axiom SA, either 
X = Oct or there are a" , y" such that x = c{a, y). In the latter case, |a;| = S\y\ > 0, so if 
= 0, then x = But if |a:;| = Sn, then x ^ Qa- and there arc a, y with x — c(a, y) 
and \y\ = n. □ 
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Proposition 2.16. E-HA"* proves the induction schema for sequences: 

A Va^ y^' ( (^(y) ^ ^(c(a, y) ) ^ V.t'^* ^(x). 

Proof. Suppose </3(()ct) and Va'^,y'^' (<^(?/) — (p{c{a,y)). It now follows from the 
previous lemma that we can prove 

Vn°Va;''* (|a;| ^n-^ip{x)) 

by ordinary induction. □ 

One consequence is the following useful fact: 

Lemma 2.17. E-HA"* proves that for any two elements x'^ , y" we have \x*y\ = |a:;| + |j/| 
and 

{x * y)i = {x)^ ifi < \x\, 
{x * y)i = otherwise. 

Therefore it also proves that x x * y and y x * y. 

Proof. Easy argument using the recursive definitions of | • | and * and the induction 
schema for sequences. □ 

Another consequence is the principle of extensionality for sequences. We will call 
two elements x"^ , j/'^ extensionally equal, and write x =e,a' y, if 

\x\ =0 \y\ A Vi < |a;| ( (x), {y)^ ). 

Proposition 2.18. E-HA"* proves 

Mx" .y" {x =eM' V ^ X =o-. y). 

Proof. Proof by sequence induction on a;. 

If X =e y and x = ()o-, then |y| = |a;| =0. So y = 

li X =e y and x = c{a, x'), then \x\ = Sn where n = \x'\. So also \y\ ~ Sn and hence 
y — c{b,y') for some b'^,y''^ with \y'\ = n. Since x ~e y, we have a ~ b and x' y' ■ 
From the latter we get x' = y' by induction hypothesis, so x = c(a,x') = c{b,y') = y. 

□ 

Corollary 2.19. ^-Wf^^ proves 

'ix"' st(|a:|) AVi < |a:| st((.T)i) st(a;). 

Proof. Suppose x" is a sequence of standard length and all components are 
standard. Then x' :~ {xq, . . . ,x\x\-i) is also standard (by Lemma l2.8p . But x ~e.a* 2;', 
so X = x' by extensionality for sequences and st(a;) by extensionality of the standardness 
predicate. □ 

Corollary 2.20. E-HA"^* proves the external induction axiom for sequences: 

A V^'a^ y^' ( $(y) ^ $(c(a, y) ) ^ Y'x'^' 
Proof. Suppose $(()ct) and V^^a'^ ,y'^ ( $(?/) — > $(c(a, y) ). The idea now is to prove 

V''n°W* = n ^ ) 

by external induction lA^*, using the previous corollary to argue that if x = c{a,y) and 
x"^ is standard, then both a and y are standard as well. □ 
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2.6 Finite sequence application 

The following operations will be crucial for what follows. 

Definition 2.21 (Finite sequence application and abstraction). If s is of type (a r*)* 
and t is of type a, then 

s[t] := (s)o(t)*...*(s)|,|„i(0 :t*. 

For every term s of type cr — >■ t* we set 

Ax-^-six) := {Xx^.six)) : (a -> r*)*. 

The point is that these two operations act like application and abstraction, for we 
have 

{Ax.s{x))[t] =r' {Xx.s{x)){t) =r' s{t). 

We will often write s[i] and Ax.h in handling these expressions, the same conventions 
as for ordinary application and abstraction apply (see Section 2.1). 

Note that the defining equations for the sequence application and A-abstraction imply 
that finite sequence application and ordinary application are (provably) interdefinable, 
in the following sense: E-HA"* proves that for every s : (cr — ?> r*)* there is a i : cr r* 
(viz., t = Ax.s[x]) such that s[x\ = t{x) for all x, as well as that for every t : a ^ t* 
there is an s of type (cr — > r*)* (viz., s ~ Kx.t{x)) such that s[x] = t{x) for all x. 

In what follows we will need that one can define recursors TZp for each tuple of types 
p* = Pq, . . . , p1, such that 

'Kp{0,y,z) =p, y, 
'Rp{'n + l,y,z) =p- z[n,]Zp{n,y,z)], 

(where yi is of type p* and Zi is of type (0 — > Pq — ^ . . . ^ ^ Pi)*)- Indeed, by letting 

Up An" , y, z.Rp, (n, y , (A#* , s] )), 

where Rp are constants for simultaneous primitive recursion as in |25| , we get 

^p(0,y,^) %(0,y, (A#*,i°.z[t,s])) =p. y 

and 

+ =p- Ep.(" + l,I,(A#*,i°.^[i,l])) 

=p_. (As£* , i°.z[t, s])(^p. (n, y, (A#* , i°.z[i, s])), n) 

=P* ^[n, % (", y, (As^^' , t".z[i, s]))] 
=p. z[n,np{n,y,z)]. 

Notice that when compared to the case of the ordinary primitive recursors Rp we have 
switched the order of the arguments of z. This is simply to make the realizer for the 
interpretation of the induction schema nicer. 

With respect to the preorder < from Definition 12 . 121 the new application is monotone 
in the first component, in the following sense: 

Lemma 2.22. E-HA"* proves 

1. If s^"-"-"'^' < l^-^-^^*)', then s[t] ^ S[t], for all . 

^- If s ^ then s[t\ ^ s[t] for all t of suitable types. 
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3- If s ^ S, then s[t] ^ s[i\ for all t of suitable types. 

Proof. We will only prove the first point, as the other two are similar. Let i < \s[t]\, and 
consider (s[t])i. Sinee s[t] (s)o(i) * • • ■ * there is fc < \s\ and m < \{s)k{t)\ 

such that 

{s[t])^ =r- {{s)k{t))rn- 

Since s ^ s there is j < \s\ such that (s)^ —^^t^ Thus m < \{s)j{t)\ and 
and so since s[t] —t* {s)o{t) * ... * there is some n < \s[t]\ such that 

□ 

Lemma 2.23. E-HA"j* proves 
and 

st'^^^'(s) ^ s&^^'^'iAx^.six)). 
Proof. Follows from Lemma [2.81 □ 

3 Nonstandard principles 

Semantic approaches to nonstandard analysis exploit the existence of nonstandard mod- 
els of the first-order theory of the natural numbers or the reals. In fact, one may use 
the compactness theorem for first-order logic or the existence of suitable nonprincipal 
ultrafilters to show that there are extensions of the natural numbers, the reals or any 
other first-order structure one might be interested in, that are elementary: that is, sat- 
isfy the same first-order sentences, even when allowing for parameters from the original 
structure. For the natural numbers, for instance, this means that there are structures 
*N and embeddings i : N ^> *N that satisfy 

*N ^ (p{i{no), i{nk)) N ^ (p{no, . . . , n^) 

for all first-order formulas (p{xo, . . . ,Xk) and natural numbers no, . . . , n^. Usually, one 
identifies the elements in the image of i with the natural numbers and calls these the 
standard natural numbers, while those that do not lie in the image of i are the non- 
standard natural numbers. Sometimes, one adds a new predicate st to the structure *N, 
which is true only of the standard natural numbers. One can then use the elementarity 
of the embedding to show that *N is still a linear order in which the nonstandard natural 
numbers must be infinite (i.e., bigger than any standard natural number). The charm 
and power of nonstandard proofs is that one can use these infinite natural numbers to 
prove theorems in the nonstandard structure *N, which must then be true in N as well, 
as the embedding i is elementary. The same applies to nonstandard extensions *R of 
the reals, in which there are besides infinite reals, also infinitesimals (nonstandard reals 
having an absolute value smaller than any positive standard real): these infinitesimals 
can then be used to prove theorems in analysis in *]R; again, one can then go on to 
use the elementarity of the embedding to show that they must hold in R as well. The 
catch is that only first-order, internal statements can be lifted in this way: so using 
nonstandard models requires some understanding about what can and what can not be 
expressed in first-order logic as well as some careful verifications as to whether formulas 
are internal. 
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Besides creating an interesting world in which there are infinite natural numbers and 
infinitesimals, nonstandard analysis also comes with some new proof principles, among 
which the following are the most important: 

1. Overspill: if ip{x) is internal and holds for all standard a;, then ip{x) also holds for 
some nonstandard x. 

2. Underspill: if ip{x) is internal and holds for all nonstandard x, then ip{x) also holds 
for some standard x. 

3. Transfer: an internal formula (possibly with standard parameters) holds in *N 
ifr it holds in N. 

Of course, transfer expresses the clemcntarity of the embedding. The other two principles 
are consequences of the fact that it is impossible to define standardness in *N using an 
internal formula: for if one could, then ip{n) would hold in *N, and hence in N, for every 
natural number n. This would imply that yxip{x) holds in N and hence in *N as well; 
but that contradicts the existence of nonstandard elements in *N. 

In the remainder of this section, we will discuss these principles in more detail, for 
two related reasons. First of all, they will provide us with three benchmarks with which 
we will be able to measure the success of the different interpretations. Also, because they 
have some nontrivial consequences (especially in the intuitionistic context), discussing 
these will give us some important clues as to how any interpretation of nonstandard 
analysis will have to look like. 

Remark 3.1. Unless we state otherwise, the principles we will subsequently introduce 
in this paper may have additional parameters besides those explicitly shown. Also 
recall that we follow Nelson's convention in using small Greek letters to denote internal 
formulas and capital Greek letters to denote formulas which can be external. 

3.1 Overspill 

When formalised in E-HA^^*, overspill (in type 0) is the following statement: 

OSo : W° (p{x) -> ( ^ st{x) A ^{x) ). 

Proposition 3.2. [40j In E-HA"j.* the principle OSq implies the existence of nonstandard 
natural numbers, 

ENSo : 3x"^st{x), 

as well as: 

LLPO^* : V"V°, y° ( ip{x) V ^(y) ) ^ V^V^ ip{x) V V^'y^ tP{y). 

Proof. ENSo follows trivially from OSo by taking for ip{x) some trivially true formula 
(for instance, x = x). 

If V^^'a;*^, ( 1^9(2;) V ip{y) ), then one can use external induction to prove: 

V^'n*^ ( V7TI < 71 (p{m) V Vto < n ^{m) ). 

By applying overspill to this statement, wc see that it holds for some nonstandard n. 
Using external induction again, wc can prove that a nonstandard natural number must 
be bigger than any standard natural number. Hence V^*a;° f{x) V V*?/" 4'{y)- ^ 

Of course, overspill can be formulated for all types: 

OS : f{x) •^3x'' sl{x) A if{x) ). 

But, actually, the interpretations that we will discuss will not only verify this princi- 
ple, but also a far-reaching generalization of it, viz. a higher-type version of Nelson's 
idealization principle |38j : 

I : V'^^x'^'By^Vx' e„xip{x\y) 3y^\/'^x^ (p{x,y). 
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Proposition 3.3. |40| In E-HA"j* the idealization principle I implies overspill, as well 
as the statement that for every type a there is a nonstandard sequence containing all the 
standard elements of that type: 

USEQ : By"' y'^'x" X y. 

Proof. OS for an internal formula ipiv) follows from I by taking ip{x, y) := y ^ xA'il'{y), 
while USEQ follows by taking ip{x,y) := x Go- y- D 

Proposition 3.4. In E-HA^^* the idealization principle I implies the existence of non- 
standard elements of any type, 

ENS : Bx^^stix), 

as well as LLPO*'* for any type: 

Proof. The first statement is obvious, so we concentrate on the second. 

Suppose V^'x'^,?/'^ {^{x) V ipiu))- Then one easily proves by external sequence in- 
duction and by taking v := u that 

Y^u"' Bv"' W eu{u' evA ( Vw' G V (p{v') V Vu' £ v V'(w') ) ) . 

By applying idealization to this statement we obtain 

Bv"' Y^u" {uevA {W £vipiv')\/W evip{v'))), 

from which LLPO'* follows. □ 

Classically, idealization is equivalent to its dual, which we have dubbed the realization 
principle (intuitionistically, things are not so clear): 

R : Vy^3"V (p{x, y) 3"V' Vj/^3x' € x ^{x' , y). 

As it turns out, both our interpretations will eliminate this principle as well. Actu- 
ally, both interpretations for constructive nonstandard analysis eliminate the stronger 

nonclassical realization principle: 

NCR : Vy^3''*.T'"$(x,2/) ^ B'^V'Vy^B.x' G x^{x' ,y), 

where can be any formula. This is quite remarkable, as NCR is incompatible 

with classical logic (hence the name) in that one can prove: 

Proposition 3.5. In E-HA^j* the nonclassical realization principle NCR implies the 
undecidability of the standardness predicate: 

-Nx" (st(a-) V -•st(a;) ). 

Proof. Assume that standardness would be decidable. Then we would have 

'iy^J'x^ {si{y)^x^y). 

Applying NCR to this statement yields: 

3"'a;'"*V2/''3x-' d x {st{y) ^ x' ^ y), 

which is the statement that there are only finitely many standard elements of type a. 
This is clearly absurd. □ 
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3.2 Underspill 

Underspill (in type 0) is the following statement: 

USo : Vx° ( - st(a;) if{x) ) ^ 3^'a;° ^^(a;). 
In a constructive context it has the following nontrivial consequence (compare [5]): 
Proposition 3.6. In E-HA^^* the underspill principle USo implies 

MP^* : (V''*a;"(v?(x) 7^(^(0;)) A --3^'xV(a;)) ^ 3''*xV(a;). 
In particular, E-HA"j*+ USo l- -'-'St"(.T) st"(x). 

Proof. We reason in E-HA^t*+ USo- Suppose V"*a;" ( ip{x) V -^ip{x) ) and -.-.3^'.T"y5(a;). 

Since the latter is intuitionistically equivalent to -iV'^'x" -1(^(2;), this means that for 
every infinite natural number uj, we have -iVa; < uj^Lp{x). In other words, we have 

"iuP ( -1 st(a;) — !> -i\/x < uj^(p{x) ). 

So by USo we have 

3'^^y—'Vx < y^ip{x), 

which implies 3^'^xip{x) by decidability of ^p{x) for standard values of x. 

As a special case we have -i-ist°(x) — st°(a:;), because st°(a;) is equivalent to 
3"*?/° ( X =0 2/ ) and equality of objects of type is decidable. □ 

Also underspill has a direct generalization to higher types: 

(JS -.yx" {^st{x) ^ <fi{x)) ^3'^ x" ip{x). 

A natural question is whether this implies a version of Markov's Principle for all types. 
Our suspicion is that this is not the case, but we were unable to prove this. 

3.3 Transfer 

Following Nelson [35], the transfer principle is usually formulated as follows: 

TPv : V=4 (V"'a;v3(x,t) ^ V.T¥>(a;,t) ). 

(Here, for once, we do not allow parameters: so it is important that x and t include all 
free variables of the formula tp.) This is classically, but not intuitionistically, equivalent 
to the following: 

TP3 : V'4(3a;(p(x,t) -> (^(x, t) ), 

where, once again, we do not allow parameters. 

It turns out that interpreting transfer is very difficult, especially in a constructive 
context (in fact, Avigad and Helzner have devoted an entire paper [5] to this issue). 
There are, at least, the following three problems: 

1. Transfer principles together with overspill imply instances of the law of excluded 
middle, as was first shown by Moerdijk and Palmgren in j37l . In our setting we 
have: 

Proposition 3.7. (a) In E-HA^^* the combination o/ENSq andTPy implies the 
law of excluded middle for all internal arithmetical formulas. 

(b) In E-HA"j.* the combination of USEQ and TPy implies the law of excluded 
middle for all internal formulas. 
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Proof. Ad (a): assume ENSo and TPy. We show that every internal arithmetic 
formula Lp is decidable by induction on the number of internal quantifiers in ip. 
Atomic formulas are decidable anyway, so the base case is easy. 

If tflx^^t) is an internal formula which is decidable and arithmetical (and with all 
free variables shown), then one can use internal induction to show 

[3x <y ^(p{x,t) V Vx < y fixjt) ). 

Let t be some arbitrary standard value and let y be some infinite natural number 
w, using ENSq- Then we either have 3x < uj-np{x,t) and in particular 3x ^Lp{x^t) 
or we have Va; < uxpix^t) and in particular V^^'x (^9(2;, i). So: 

( 3x -nip{x, t) V W (^(a;, t) ). 

Applying TPy once we get 

( 3x ^ip{x, t) V Vx ip{x, t) ) 
and applying it another time we get 

Vi ( 3x -^Lp{x, t) W yx ip{x,t)). 
This completes the induction step. 

In (b) we argue similarly. First, we use the extensionality principles for functions 
and sequences to eliminate all equality predicates at higher types in favour of 
equalities at type 0. This makes all atomic formulas decidable. Since decidable 
formulas arc closed under all prepositional connectives, this leaves the case of the 
quantifiers. So suppose </3(x'^,t) is a internal formula which is decidable and let u 
be a sequence containing all standard elements of type a (using USEQ). Then we 
have: 

3u' G u -^ip{u' ,t) V Vu' G u ip{u ,t). 

In the former case it holds that 3x'^ ^Lp{x^t) and in the latter that \/^*^x"'(p{x,t). 
And from here the argument proceeds as before. □ 

2. As Avigad and Helzner observe in [S], also the combination of transfer principles 
with underspill results in a system which is no longer conservative over Heyting 
arithmetic. More precisely, adding USq and TPy, or USq and TPg, to E-HA^^* 
results in a system which is no longer conservative over Heyting arithmetic HA. 
The reason is that there are quantifier-free formulas A{x) such that 

HA\/ ^^3xA{x) 3xA{x). 

Since one can prove a version of Markov's Principle in E-HA"j*-|- USq, adding either 
TPy or TP3 to it would result in a nonconservative extension of HA (and hence of 
E-HA"^*). We refer to [5] for more details. 

3. The last point applies to functional interpretations only. As is well-known, in the 
context of functional interpretations the axiom of extensionality always presents a 
serious problem and when developing a functional interpretation of nonstandard 
arithmetic, the situation is no different. Now, E-H A"j* includes an internal axiom of 
extensionality (as it is part of E-HA"*), but for the functional interpretation that 
we will introduce in Section 5 that will be harmless. What will be very problematic 
for us, however, is the following version of the axiom of extensionality: if for two 
elements f,g of type cti ^ (0-2 • ■ • ^ 0)), we define 

f=^'g := V^'4^4^... {fx=ogx), 
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then cxtcnsionality formulated as 

V^VV^*^,2/(x=^*y^/x fy) 



will have no witness definable in ZFC. But that means that also TPy can have no 
witness definable in ZFC: for in the presence of TPy both versions of extensionality 
are equivalent. 

One way out of this quandary, which is strongly suggested by the last point and 
is the route taken in most sources (beginning with |36p. is to have transfer not as a 
principle, but as a rule. As we will sec, this turns out to be feasible. In fact, we will 
have two transfer rules (which are not equivalent, not even classically): 

y^^-xifix) 3xip{x) 
vxif{x) d'"-x(p{x) 

(This time round there are no special requirements on the parameters of (p.) 

Remark 3.8. In this section we have also explored several connections between non- 
standard principles. More principles will be introduced below and we will prove one 
more implication (see Proposition I5.11|) . We have not tried to determine the precise 
relationships between these principles - in particular, we do not know precisely which 
principles follow and do not follow over E-HA"j* from combinations of other principles. 
In fact, we believe that mapping these connections would be an interesting research 
project. 



4 Herbrand realizability 

In this section we will introduce a new realizability interpretation, which will allow 
us to prove our first consistency and conservation results in the context of E-HA"j*. 
Our treatment here will be entirely proof-theoretic; for a semantic approach towards 
Herbrand realizability, see [5]. 



4.1 The interpretation 

The interpretation works by associating to every formula ^(x) a formula ^'(i, s), also 
denoted by t hr$(a;), where i is a tupe of new variables all of which are of sequence 
type, determined solely by the logical form of ^{x). The soundness proof will then 
involve showing that for every formula ^{x) of E-HA"^* with E-HA"^* h ^{x) there is an 
appropriate tuple t of terms from T* such that E-HA"^*|- t hr<I>(x). 

The idea of the interpretation is that we interpret internal quantifers uniformly and 
that we do not attempt to give them any computational content. In a sense, the only 
predicate to which we will assign any computational content is the standardness predi- 
cate st: to realize st'^(a;), however, it suffices to provide a nonempty finite list of terms 
of type CT, one of which will have to be equal to x. Therefore to realize a statement of 
the form 3^^x'^ ^(x) one only needs to provide a finite list {yo, . . . , y„) and to make sure 
that ^{yi) is realized for some i < n (which is like giving a Herbrand disjunction; hence 
the name "Herbrand realizability" ) . 

The precise definition is as follows: 
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Definition 4.1 (Herbrand realizability for E-HA^j.*). 

[] Ur if := if for an internal atomic formula f, 

s hrst(a;) := x € s, 

s,thr(i>V*) := shr^Vthr^, 

s,thr((I>A*) := shr(f> A thr*, 

shr($^*) := V"*t ( <hr$ s[t] hr*), 

sUr3x^{x) := 3x (shr$(x)), 

shrVx$(a;) := V.t (shr$(x)), 

s,thrJ'^x^{x) := 3s' e s ( t hr $(s') ) , 

shrV"'x$(x) :ee V"*a: (s [x] hr $(a;)) . 

Before we show the soundness of the interpretation, we first prove some easy lemmas: 

Definition 4.2 (The 3*^* -free formulas). We call a formula (in the language of E-HA"^.*) 
B'^^-free, if it is built up from atomic formulas (including _L) using the connectives A, V, 
and the quantifiers 3x, Vx and V^^x. Alternatively, one could say that these are the 
formulas in which st and 3*** do not occur. We denote such formulas by $^st. 

Lemma 4.3 (Interpretation of 3^' -free formulas). All the interpretations i.hr$(x) of 
formulas ^{x) of E-HA^^* are 3^' -free. In addition, every 3*^' -free formula is interpreted 
by itself. Hence the interpretation is idempotent. 

The following lemma will be crucial for what follows: 

Lemma 4.4 (Realizers are provably upwards closed). The formula i hr$(x) is provably 
upwards closed in t, that is: 

E-HA"t*l- shr$As ^ t ^ihr$. 

Proof. By induction on the structure of $, using the monotonicity of the new apphca- 
tion in the first component in the clauses for and V*^' . □ 



Theorem 4.5 (Soundness of Herbrand realizability). Let $ be an arbitrary formula of 
E-HA^j* and A^st be an arbitrary set of -free sentences. Whenever 

E-HA^t*+A^.t h $(x), 

then one can extract from the formal proof closed terms t in T* , such that 

E-HA"t*+A^t h ihr$(x). 

Proof. As for the logical axioms and rules, the differences with the usual soundness 
proof of modified realizability for E-HA'^ (as in [IS] or Theorem 5.8 in [55]) are 

(a) that we require the realizing terms to be closed, 

(b) that we have a nonconstructive interpretation of disjunction, and 

(c) that we interpret the quantifiers in a uniform fashion. 
Therefore one has to make the following modifications: 

1. The contraction axiom AW A — ^ is realized by Ax, y.x*y, using that the collection 
of realizers is provably upwards closed. 

2. The weakening axiom A ^ AV B is realized by Ax.x, O. 
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3. The permutation axiom A\/B^B\/A is realized by Ax, y.y, x. 

4. The axioms of V-climination Vx$(a;) — > $(i) and 3-introduction 3x^{x) 
are realized by the identity tuple . a;. 

5. The expansion rule ^vc^Avc • thr A — > B, then Ax, y is a Hcrbrand 
realizer of AvC^AvC. 

6. The V-introduction rule $'*!^^4^^) interpreted, because shr($ ^> ^(2^)) im- 
plies shr($ — ^ Vx^'(x)): for if thr $ and st(i), then s[i] hr ^{'(a;) and therefore 
s[t] hrVa;*(a;). 

7. The 3-introduction rule gf^^^^^, is interpreted, because shr($(a;) — 5- '5) im- 
plies s hr(3a;$(j;) ^'): for if thr3x^{x) and st(t), then there is an x such that 
thr^{x), from which it follows that s[t] hr^P. 

The sentences from A^at and the axioms of E-HA'^*, including SA and the defining 
axioms for equality, successor, combinators and recursion, are 3*^* -free and therefore 
realized by themselves. Therefore it remains to show the soundness of the following 
rules and axioms: 

1. The external quantifier axioms EQ: both directions in 3''*x$(a:) ^ 3a;(st(a:) A$(a:)) 
are interpreted by the the identity. In W^*-x^{x) Va;(st(a;) ^{x)) the right-to- 
left direction is realized by As, x.s [(x)], while the left-to-right direction is realized 
by As,x.s[xo] * . . . * s[x|^|„i]. 

2. The axiom schemes 7^^: the principle st(a;) A x = y — )■ st{y) is realized by the 
identity, while st{t) is realized by (t). In addition, st(/) A st(a;) s,t{fx) is 
realized by A/, a;.(/i(xj))j<|/| j<|^| . 

3. The induction schema lA*"* : suppose shr<i>(0) and i hr ^'^(^(ri) $(n + l)), with 
st(s) and st(t). Then E-HA^^.* proves by external induction that for standard nat- 
ural numbers n, the term ]Z{n,s, t) is standard and ]Z(n,s, t) hr$(n). Therefore 
Ax,y,n . TZ{n,x, y) hrlA*"* . 

□ 



4.2 The characteristic principles of Herbrand reahzability 

In this section we will prove that HAC (the hcrbrandized axiom of choice), HlP^st (the 
herbrandized independence of premise principle for 3^'-free formulas) and NCR axiom- 
atize Herbrand reahzability: 

1. HAC : 

W3''*y $(a;, y) -> 3'^*FW3y G F{x) $(x, y), 

where ^{x,y) can be any formula. If ^{x,y) is upwards closed in y, then this is 
equivalent to 

V"'a;3'^*y*(a;,2/) ^ 3'^Wa; <I>(x, F(a;)). 

2. HlP^at: 

($ ^ 3^'y^fiy)) ^ 3^V(* ^ V e y^{y')), 

where $ has to be an 3'^*-free formula and ^'(i/) can be any formula. If '^{y) is 
upwards closed in y, then this is equivalent to 

($^?*y*(y)) ^?*2/($->*(2/)). 



18 



3. NCR: 

Va;3''*?/ <I>(x, y) 3"'?/ Vx 3y' E y ^{x, y'), 

where ^{x,y) can be any formula. If is upwards closed in y, then this is 

equivalent to 

Va;3*''j/(f>(x,?/) B^'yVx $(a-, y). 
Theorem 4.6 (Characterization theorem for Herbrand realizability). 

1. For any instance $ of HAC, HlP^st or NCR, there are closed terms t in T* such 
that 

E-HA"t*h ihr$. 

2. For any formula $ of E-HA"^, we have 

E-HA^t*+ HAC + HIP^.t + NCR h $ o B'^^a; (x hr$). 

Proof. Soundness of HAC: If r = s,t and rhry^^x3^*^y^{x,y), then for 
every standard x there is an s' G s[x] such that t[x]hr^{x,s'). Hence 
{Xx.s[x]),thr3''^Fy''*'x3y € F{x) ^{x,y). So HAC is realized by Ax,y.{Xz.x[z]),y. 

Soundness of HlP^st: Suppose $ is B'^'-free, r — s,t and rhr$ — >• 3^*'y(^{y). This 
means that if $ would hold, then there would be an s' G s such that thr^'(.s'). Hence 
(s),i hr3*'*y($ 3y' e y'^{y')). So HlP^t is realized by Ax,y.{x),y. 

In a similar manner one checks that also NCR is realized by Ax,y.{x),y. This com- 
pletes the proof of item 1. 

Item 2 one proves by induction on the logical structure of 3>. We discuss implication 
as an illustrative case, as it is by far the hardest, and leave the other cases to the reader. 
We reason in E-HA"j*+ HAC + HlP^st + NCR. By induction hypothesis, we have that 
$ ^ 3''*<(i hr$) and vj/ o 3*''s(s hr*) and therefore 

$ vfi 

is equivalent to 

3'^*t(i hr$) ^ 3'''s(shr^'), 

which in turn is equivalent to: 

V"4(thr* ^ 3"*s(shr*)). 

Because i hr$ is B'^'-free and s hr^I' is upwards closed in s, we can use HlP^st to rewrite 
this as: 

V"43"'s (thr$ ^ shr*). 

As thr^ — > shr^I' is upwards closed in s and finite sequence application and ordinary 
application are interdefinable, we can use HAC to see that this is equivalent to: 

3"'sV"*t (thr$ ^ s[t] hr^-), 

which is precisely the meaning of ( s hr($ ^> 5') ). □ 

Theorem 4.7 (Main theorem on program extraction by hr). Let y'^^x3^^y^{x,y) be a 
sentence of E-HA^j* and A^st be an arbitrary set 3^^-free sentences. Then the following 
rule holds 

E-HA^t*+ HAC + HIP^.t +NCR + A^.t h V"'x B'^'y $(a:, y) ^ 
E-HA^t*+ HAC + HlP^^t + NCR + A^.t h V^'a: 3y e t{x) $(a;, y), 

where t is a closed term from T* which is extracted from the original proof using Her- 
brand realizability. 
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In the particular case where both ^{x,y) and A^st are internal, the conclusion yields 

E-HA"* + A^st h Va; 3y £ t{x) ^{x, y). 

If we assume that the sentences from A^at are not just internal, but also true ( in the 
set-theoretic model), the conclusion implies that Vx Ely £ t{x) ^{x,y) must be true as 
well. 

Proof. If 

E-HA^t*+ HAC + HlP^at + NCR + A^at f- V'^a; 3"*?; <^{x, y), 

then the soundness proof yields terms r, s such that 

E-HA^t*+ A^at h r,shrV''a; 3*^*2/ 

Since r, shr\/^^x3^^y ^{x,y) is by definition V^*a;3y £ r[x]{shr^{x,y)), the first state- 
ment follows by taking t = Aa;.r[a;]. 

If both J/) and A^t are internal, then s is empty and we get 

E-HA^t*+ A^at h V"'a;3y £ t{x) ^{x,y). 

By internalizing the statement, we obtain 

E-HA"* + A^at h 3y £ t{x) $(a;, y). 

Since all the axioms of E-HA"* are true, this implies that Vx3j/ £ t{x) ^{x,y) will be 
true, whenever A^st is. □ 

4.3 Discussion 

The main virtue of Herbrand realizability may be that it points one's attention to princi- 
ples like HAC and NCR and that it gives one a simple proof of their consistency. However, 
as a method for eliminating nonstandard principles from proofs, Herbrand realizability 
has serious limitations. It does eliminate the realization principle R (it even eliminates 
the nonclassical principle NCR), but overspill, the idealization principle I and the trans- 
fer rules are 3''*-free and therefore simply passed to the verifying system. Even worse, 
the underspill principle USo does not have a computable Herbrand realizer: 

Proposition 4.8. MPq' and USo do not have computable Herbrand realizers. 

Proof. It is well-known that there can be no computable function witnessing the 
modified realizability interpretation of Markov's principle, because its existence would 
imply the decidability of the halting problem. A similar argument shows that M Pq* does 
not have a computable Herbrand realizer: Kleene's T-predicatc T{e, x, n) is primitive 
recursive and hence 

E-HA^t* I- V'^'e, X, n( r(e, x, n) V -T(e, x,n)). 

So if MPq* would have a computable realizer, then so would 

V"*e ( ^^3''*n r(e, e, n) 3"*n T(e, e, n) ) . 

But if t would be such a realizer, we could decide the halting problem by checking 
T{e,e,n) for all n £ t[e]. 

Since USq implies MPq* (see Proposition 13. 6p . it follows that USo does not have a 
computable realizer either. □ 

In the next section, we will show that these problems can be overcome by moving 
from realizability to, more complicated, functional interpretations. 
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5 A functional interpretation for E-HA^^* 

In this section we will introduce and study a functional interpretation for E-HA^^*. 
5.1 The interpretation 

The basic idea of the Dgt -interpretation (the nonstandard Dialectica interpretation) is 
to associate to every formula $(a) a new formula $(a)^=' = B^^aN^^y (pD^t feiZ/jO) such 
that 

1. all variables in a; are of sequence type and 

2. ifD^t iS-i UtS:) is upwards closed in x. 

We will interpret the standardness predicate sf^ similarly to the case for Hcrbrand 
realizability: For a realizer for the interpretation of st'^(x) we will require a standard 
finite list (yo, ■ • ■ , Un) of candidates, one of which must be equal to x. 

Definition 5.1 (The Z3st -interpretation for E-HA"^*). We associate to every 
formula $(a) in the language of E-HA^^* (with free variables among a) a formula 
$(a)^=' = 3'^*xV'''j/ (^o^j {2L,y,a) in the same language (with the same free variables) by: 

(i) fia)^'^ fD^jt {&) '■= foi' internal atomic formulas ^{a), 

(ii) st'"(w'")^=* := 3"*a;'"*u X. 

Let $(a)^=' = 3''*xV''*y(^D^, {x,y,a) and 'i'(6)'"=' = 3"*uV'*wV'D=t {u,v,b). Then 

(iii) ($(a) A *(6))^=' :=3"*2,?iV%u((/7_D^. (x,y,a)Ai/.i5^, (m,w,5)), 

(iv) ($(a) V *(fe))^- ■■=^''i:,uy%v{ipD^^ix,y,a)WiPD^Au,2l,b)), 

(v) ($(a) ^ vl/(6))^- ly^'x, v (Vy e Y[x, v] Vd^, (s, y, a) ^ Vd,, (f/fc] , v, k)) . 

Let (f>(z,a)^=' = 3'^*xV"^'y (/3Dat (31, 2/,z,a), with the free variable z not occuring among 
the a. Then 

(vi) (Vz$(z,a))^=' :=3''^xW''^yyzipD,,{x,y,z,a), 

(vii) (3z$(z,a))^=' := 3"'xV''*2;3zVy^ G y VSd^, (x z, a), 

(viii) (V^*z$(z,a))^- :=3^Wz,yv'i?..(^N,y,^,«), 

(ix) (3''*z$(z,a))-°=' := B''*^, zV'^'yBz' e zVy' e y<^£),t (£,y^, -^'ifi)- 

Definition 5.2. We say that a formula $ is a V^'-formula if $ = \/^^xip{x), with (/'(x) 
internal. 

Lemma 5.3. Let ^ be a V""^ -formula. Then = $. 

Proof. By induction on the structure of $. □ 

Notice that because of the clause for the interpretation is not idempotent. Sim- 
ilarly to what is the case for Hcrbrand realizability it will be crucial that realizers are 
upwards closed: 

Lemma 5.4. Let ^{a) be a formula in the language of E-HA^^* with interpretation 
Ej'^'xV"^*?; <y9£)gj {x,y,a). Then the formula (po^t fe, yJ^^) ^■s provably upwards closed in x, 
i.e., 

E-HA'^* h pD,t {x,y,a) Ax^x'^ v'-Dst ix\y,a). 
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Proof. By induction on the structure of $(a), using Lemma [2.221 in the clauses for — > 
and V"'. □ 

The Dst -interpretation will allow us to interpret the nonclassical realization principle 
NCR, and also both I and HAC. Additionally we will be able to interpret a herbran- 
dized independence of premise principle for formulas of the form y'^*'xip{x), and also a 
herbrandized form of a generalized Markov's principle: 

1. HIPv=t: 

(y^'x^ix) ^ B'^'y^iy)) ^ 3''y (V^'x^ix) 3y' G y 

where ^{y) is a formula in the language of E-HA"^* and ip{x) is an internal formula. 
If ^(y) is upwards closed in y, then this is equivalent to 

(Y'x^ix) ^ B^'yfiy)) ^ 3''y {Y'x^{x) -> ^{y)). 

2. HGMP"*: 

(y'^'x^ix) -^^)-^ B'^'x (Vx' 6 xifix') V), 

where ip{x) and ip are internal formulas in the language of E-HA^j*. If ip{x) is 
downwards closed in x, then this is equivalent to 

(V^'xifiix) -> V) -> 3"'x{(p{x) -> V)- 

The latter gives us a form of Markov's principle by taking -0 = 0—01 a-nd 
1^9(2;) = -'ipQ{x) (with ipo{x) internal and quantifier-free), whence the name. 

Theorem 5.5 (Soundness of the Z?st -interpretation). Let $(a) be a formula o/E-HA"^* 
and let A\nt be a set of internal sentences. If 

E-HA^t*+ I + NCR + HAC + HGMP"* + HlPy^t + Aint K $(a) 

and ^{a)^^^ = 3^*'x\/^*^y (p^^^^ (Siyifi); then from the proof we can extract closed terms t 
in T* such that 

E-HA'"* + Ai,thVy^D,t {hy,a). 

Proof. As in the proof of the soundness of the Dialectica interpretation we proceed by 
induction on the length of the derivation. 

1. We will first consider the logical axioms and rules: 

(a) A-^AaA: 

With A^"^ = 3^*-xi^^y (p{x,y,a) wc have 

{A^ AA A)^=' = rV'^'a;,y',y" 
(Vz e ^ v{Xl[x],]/,a) A (/9(X"[x],y",a) 

and we can take 



Y 



= Ax.jT, 

= Ax.x, 

= A£,y',y".(2/',2/"). 



(b) Ay A^A: 

With A^'^^ = J'^xi^^yip(xi,y,a) wc have 

{Ay A^ A)^- = y" 
((Vz e i:[2,^',y'X£,2,a) V Vz^ e i:'k,^',y'>fe',^,a)) 

^^(r'feai'],y",a)^ 
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and we can take 

X " := Ax,x'.a;*x', 
Y Ax, 

(c) ^ ^ A V S: 

With A°-^ = 3"*xV"'y V3(x,y,a) and 5^=' ee 3"*uV"'i) w,^) we have 
and we can take 

X ' :~ Ax.x, 
Y_ ■= Ax,y,v ■{]/), 
U := Ax.O. 

(d) A A B ^ A; 

With A^=' = B'^'x^'y V3(x,y,a) and 5-°=' = 3''*-u\/''*'v^p{u,v,b) we have 

(Vz e e V[x,u,y^]{ip{x,z,a) A ijjiu,t,b)) ipiX![x,u],l/,a)y 

and wc can take 

X ' := Ax, u.x, 
r Ax,u,y'.(|0, 
Z := Ax,u,y.O. 

(e) A V B ^ B V A: 

With A-''-' = B^'^xVV V'fejyja) and 5^=' ee B^^mV^'w ^) we have 

(A V B ^ B V = 3"*t/', X', r , ZV'*x, u, w', y' 

(v^ e ll[x, u, w', y'] e y [x, u, y'] (y'fe, 2, a) v Vdi, ^)) 
^{i^iU' k, uiv\b)W^ iX' [x, u] , y' , a)) ) , 

and we can take 

U_' := Ax, u.w, 
:= Ax, u.x, 
Y Ax,w,w',y'.(|0, 
y Ax,u, w', y' . (u'}. 

(f) AAB->BAA: 

Wc can take the same terms as for A VB B\/ A, since V and A arc handled 
in the same way by the interpretation. 

(g) ±^A: 

With A^'^ = B^^'xV^'y (/3(x, y,a) we have 

(± ^ A)^- = 3^*XV^*y (± ^ ^{X,y,a)), 
and wc can take X -.^ O. 
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(h) MzA A\tl2\: 

With A-^"' = y, z, a) we have 



{^w_ e y']Vz </5(a;, W7, z, a) — ^ y', t, a)^ , 



and we can take 



X ' := Ax-S., 
r := Aai,y'.(y') 



(i) A^lz\ 3zA: 

With = y, z, a) we have 

^Vw G ll[a;, y'] 1^9(2;, w, t, a) — > BzVu; £ y' z, a)^ , 



and we can take 



X' := Kx.x, 
Y := Ax,y'.y'. 



(j) The modus ponens rule: 

We assume that we have terms ti and T_2,Tj^ reahzing the interpretations 
of respectively A and A — _B, and we wish to obtain terms 7^ 
realizing the interpretation of B. So with A^^*- = ^^^x^/^'^y ip{x,y,a) and 
j^D^t = 3^*- 2^^^ 211^(11,21,11) we have 

E-HA"* +Ai,thVy y, a) 

and 

E-HA"* + Aipt h Vx,w (Vz e r3[2,w] ipix,z,a) ipiT2[x],21,b)). 
With :=T2[ii] we get 

as desired, 
(k) The syllogism rule: 

We assume that we have terms Tj^ , and , T4 realizing the interpretations 
of respectively A ^ B and B ^ C, and wc wish to obtain terms T_^,2^ 
realizing the interpretation of A ^ C. So with A-^'^* = ^^*^x\f^^y ip{x,y,a), 
QD^t = 3''*wV"'2;?/'(u,i;,&), and C^^^' eee 3VV"*zx(w, z,c) we have" 

E-HA'^* + Aint ^ V^,w(VieT2[£,w]v5fei,a) ^ ^'(rife], w,^)) (1) 

and 

E-H A-* + Ai,t h V«, z (Vj e T4 [«, z| V(u, J , h) ^ x(Z3 M , ^, fi)) , (2) 
and we wish to obtain Tg , Tg such that 

E-H A"* + Aint V- Vx, z (Vfc e Tg [x, z] (^(x, fc, a) xiZs k] , z, c)) . 
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Todo this we let T5 --^ kx.Z'i[T-i[x\],Tj '-^ kx, z.T^[T^[x\, z\ and apply © 
with u — Tj^ [x\ , such that 

E-H + Ai,t h Vai, z (Vj G T,[x, z] i^{T, [x] ,j_,b) ^ xil^ k] , 1, c)) . 

As a special case of ([T|) we get 

E-HA"* + Aint h Vx, zVj G T7[a;, z] 
(Vi G r2 [x, j] (p{x, i, a) iIj{T^ [x] , j , b)) , 

and thus 

E-HA"'* + Aipt h Vai,z 
(Vj G Tj [x, z] Vi G T2 [x, j] i, a) -> xl^s I^l > ^> c)) . 

Hence it is enough to construct terms Tg such that 

[X, z] T2 [X, Tj [x, z]o}*a_---*aT2 [x, T7 [x, z] | [x,z} \ - 1 ] , 

where the concatenation is to include T2[iLj217[x, z\j] for each j < |r7[x, z]|, 
which one can easily do using terms from T* . 

(1) The importation and exportation rules: 

With = B'^'sV'^'y v?(x,y,a), = B'^wV^'w ■(/'(^i, and 

(jD^t ^ 3^^uN^*'zx{w,z,c) we get 

(AaB ^ C)^=' = B^^W, Y, VW^'^x, u, z 
(yieY[x,u,z]yieVlx,u,z\{ip{x,ia) A ip{u,i,b)) xiW.[x,u],z,c)j 

and 

(Vi G ll[^,w,z] i^(2,i,a) ^ {yieV[x,u,z]ip{u,i,b) ^ x{W.[x,u], z,c))y 

so that the same terms realize the interpretations oi A A B — s> C and 
^ ^ (S ^ C). 

(m) The expansion rule: 

We assume that we have terms Ti, realizing the interpretation of A — > _B, 
and we wish to obtain terms T 3,2^4, 21^,2^ realizing the interpretation of 
CVA->-C\/B. So with A^-* = 3"*xV"*y(p(x,y,a), = 3"*uV"'w 21, 

and C^=' = B'^*'wy^*'zx{w, z,c) we have 

E-HA"* + Ai„t h Vx, w (Vi G Tr^[x,v] (p{x,i,a) V'CXi [£],«,&)), 

and we want T3 , 7^ , , Tg such that 

E-HA"* + Aipt ^ 

x{T3[w,x\,z!,c)V Tp{TU[w,x],v,b)y 

Thus we can take 

213 := Aw, 

214 := Aw, ^.ri[x], 

Tg := A w, X, 2.', w . T2[3I, I!.]- 
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(n) The quantifier rules: 

i. We assume that we have terms Ti 1 2^2 realizing the interpretation 
of B ^ A, and we want terms TsiZli realizing the interpretation of 
B — > \fzA, where z is not among the free variables of B. Thus with 

^-Dst ^ 3^^xi^^y(p{x,y,z,a) and = 3^^ui^*-vip{u,v,b) we have 

E-H A"* + Aint h Vm, y {Vi G T2 [u, y] ^(u, 6) ^ (/?(ri [u] , z, a)) , 
and we want 

E-HA"* + Ai,t K yu,y{yi G r4[^i,y] V' ^ Vz^(T3[H],y,z,a)). 

Hence we may take Tg := Tj^ and T4 := Tj- 

ii. We have terms T_i,T_2 realizing the interpretation of A — >• B, and we 
want terms T_^,T_^ realizing the interpretation of 3zA — ^ B^ where z is 
not among the free variables of B. Thus with = 3^^xi^^y (p{x, y,z,a) 
and B^'^ = 3^*'y^^*'v'ip{u,v,b) we have 

E-H A"* + Aint ^ Vx, V (Vz G T2 v] ip{x, i,z,a)^ ip{T^ [x] , v, b)) , 

and we want 

E-HA'^*+Aint h Vx,u (Vfc G Ti[x,v] 3z\/i G fc(/?(x,i, z,a) ^ V'lrak],!^,^))- 
So we can take Tg := and := Ax, w . (X2[£i2i] )• 

2. The nonlogical axioms of E-HA"*: These axioms are all internal, and so their 
Dst -interpretations are all realized by the empty tuple of terms. 

3. The defining axioms EQ of the external quantifiers: 

(a) V"'a;$(a;) ^ Vx(st(a;) ^ $(x)): 

We treat first V''*^ <^{x) -> Vx(st(x) -> <I>(.t)). With = 3''^ui''^vip{u, v, x, a) 
we get 

(V''a;$(x))^=' = 3'W'a;,w</j(i/[x],w,x,a) 

and 

(Vx(st(a;) ^ $(2;)))^=' = 3^*t/Vz,i;'Vx (x G z -> (/j(f/'[z],2;',x, a)), 

and thus {Y^x<i>{x) Vx(st(x) -> $(x)))'°'' is 

3'*^',^,ZV"*C/,z,i;' 
(vi G X[U,z,2/]\/j_eV[U,z,v;](p{U[i\,j_,i,a) ^ Vx(x G z ^ (/?(£'[[/, z], w', x, a))) . 

Let now 

X := AC/, z,w'.z, 
F := AL[,z,w'.(^, 

^' := A£,z.[/[zo]*...*i/[2|,|_i] 

(with 

[/[zo] * . . . := f/o[zo] * ... * ?7o[^|z|-i], • • • , t^„_i[zo] * ... * ?7„[z|^|_i] 

for C/ = C/o,...,t/„_i). 
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Next we treat Va;(st(a;) — ?> — > V^^'x $(a;). Similarly to the case above we 
get that {\/x{st{x) $(a;)) -> V"'x$(x))^'' is 

Hence we can take 

Z := AU!,x,v.{{x)), 
Y := AU^,x,v.(g)_, 

U Af/',a;.C/'[(a;)]. 

(b) O 3a;(st(x) A $(x)): 

First we treat 3*** a; -> 3a;(st(x)A$(x)). With = 3'''iiV"'V</'(M, a) 
we get 

and 

(3x(st(x) A$(x)))^=' =3''*z,MVy3.T'Vje2;'(x'ez A ^{vf , J_, x\ a)) , 
and thus (3^'x-<I>(x) 3a;(st(x) A $(a;)))^" is 

^VZ G V.[lt, X, v'] 3fc G .T Vn G 1 (^(u, Hi fcj S:) 
3x'Vj Gi^'(a;' G Z[u,x] A "ysdZ-'il*: a;], x', a)) 



Thus we can take 



Z 
V 



= Ku,x.x, 
= Au,x.u, 
= Au,x,v'. («'}. 



Finally we consider 3x(st(x) A <&(x)) — > 3^*x $(x). Similarly to the case above 



we get that (3x(st(.T) A ^ 3''*x$(x)) 

B''^U,X,V!\/^^z,u',v 
(yi G V'[z,v;,v] 3x'Vj G l{x' G z A j,x',a)) 

3fc G u'] Vn G HV^d^l-^^j^i'ljIij fi)^ • 

Let now 



X 

U 

v 



= A z, u', u . (v). 



The schemata Tgl- 

(a) st(.T) A X = y — !• st(y): We have that (st(x) A x = y — st(j/))"'''" is 
3*^*^*^ (xGuAx = y^yG V^[it]), 
and so wc can take V := Au .u. 
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(b) st{t) for closed terms t in T*: Since 

(st(O)^'" = ^"'xt e X, 

we can take x := (f). 

(c) st(/'"^^) A st(a;'^) ^ st(/(x)): We have that (st(/) A st(a;) ^ st(/(a;)))'°'" 
is 

hence it is enough to construct a closed term W such that 

=r* {ui{vj) : i < \u\,j < \v\), 
and this we can do easily using closed terms from T*. 

5. The external induction axiom I A*'': We will consider the equivalent external in- 
duction rule 

t $(0), ^^^^"(^(n) ^$(n + l)) 

fr'om which one can derive lA**' by taking 

$(m°) := *(0) A V''n°(*(n) ^ + 1)) ^ *(m). 

We assume that we have terms Ti and T_2,Tj^ realizing the interpretations of 
3>(0) and y^*-nP{<^{n) $(n + 1)), and we wish to obtain terms realizing the 

interpretation of V'^*n°$(n). So with (<I>(7i)) °' = El'^'xV*'*j/ y, n, a) we have 
E-HA"* + AinthV£(^(Ti,y,0,a) 

and 

E-HA"^* + Aint hV7iO,£,y' 
(Vi e Tr^[n,x,i/] (pix,i,n,a) -> (p{T2[n, x],]/ ,n + l,a)^, 

and we want 

E-HA"^* + Aint h VnO,y (^(T4[n],y, n,a). (3) 
By taking T4 —An". n{n, Ti^T^) we get 

E-HA"*+Ai,t K TM=^T, 
E-HA"*+Aint h- Ti[n + l]=pT2[n,2U[n]l 

which suffices to establish 

6. The principles I, NCR, HAC, HlPyst, and HGMP"': 

(a) I: The Dgt -interpretations of the premise and the conclusion of any instance 
of I are identical, and it is easy to show that Aa; . (a;) realizes the interpretation 
of the whole implication, provably in E-HA'^*. 

(b) NCR: Suppose ($(x,y))^'' = B^'mV^S (^(u, w, x, y). Then 

(Va;3'*y*(a;, y))^" = 3'*m, 2/ V^'w Va; 3i G yVj G vip{u,j_,x,i) 

and 

{3^^y\/x3k G ?;$(a:,fc))^=' ee 
yy^^vBm G J/Vn G v\/x3k G mVZ G n^{u, L x, fc) , 
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and so (Vx3'''?/ <J>(a;, y) B'^^yVxBk G y$(a:, fc))^" is 

3''^U,Y,VY*u,y,v 
(yi G V_[u, y, u] Va; 3j G yVfc G i (/3(m, fc, x, j) 

3m G Y[u, y] Vn G w ViBA: ^ m\/l^ nip{U[u, y],l, i, fc 
Thus we can take 



u 


:= Au,y 




Y 


:= Au,y 




V 


:= Au,y, 


v.v 



(c) HAC: Let {<^>{x,y))^'' = a;, y). Then (V^^'xa^'y is 

3"'[/, rV^'x, wBi G r [a;]Vj G vipiU[x] , j , x, i) 

and (B'^tFV^'xBi G i^(.T) $(a;,i))^'" is 

3"*U;, FV"*i, i3fc G i^V; g iV™ G £3i' G fc(/)V/ G Tntp{U[l],f_,l,i'), 
so (V"*a;3''*y$(.T,y) ^ 3''^FW''^x3i G is 



(yn G X[[/,y,i,£]Vn' G Z[C£, G F[n]Vj G n' (^(EM, J, «) 

3fc G F[C/,r] V/ G iVmevBi' G fc(0 V/ G m<^(^[C/, F] i' 
Hence we can take 



U 
F 
X 
V 



= AU,Y .{Xx.Y[x]), 
~ AC/, Y, i, C . a;, 
= AU_tY,x,v.v. 



(d) HlPy.t: Let = 3''*wV'*w lAl", y)- Then (V^'x</j(x) ^ 3^'y1'(?/))^" 



IS 



3^*1/, r, XV^'w (^Vfc G X[v] ip{k) -^3ie Y\ll ev^{U, i) 
and (3"*y iy'^xLpix) ^ 3i G is 

3''*C/, X, yy'^vBn G ?;Vm G v (^Vfc G X[m] (p(fc) ^ 3i G n G mip(^U_,j, 
so the Z^st -interpretation of H I Pv=t is 

3"*^,x,y,]/V"'c/,r,x,w 
(yieV[U,Y,X,v] (Vfc G X[l\ip{k) -^3ie Yyielip{u,i,i)) ^ 

3h G Y[U,Y,X]\fmev{\fk G ^[iZ, ^] ^ 
3i G n Vj G m V' (^[iZ, i^, ^] J, ^) ) ' 

Hence we can take 



U 
X 
Y 
V 



^ AU,Y,X.U, 

= AU,Y,X.X, 

= AU,Y,X.{Y), 

= AU,Y,X,v.v. 
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(e) HGMP"*: The D^t -interpretation of HGMP"* is 

B'^'Xy^'^x (^{W e x^{x') ^ij) ^ 3j e X[x]{yk G j(p{k) v^)), 
and we can take X := Ax . (x). 

□ 

Theorem 15.51 implies the following conservation result, which improves on Moerdijk 
and Palmgren [37] and Avigad and Helzner [S]. 

Corollary 5.6. The system 

E-HA^j*+ I + NCR + HAC + HGMP"* + HIPv=t 
is a conservative extension of E-HA"* and hence of E-HA". 
Proof. By Theorem [23] and Lemma 1^751 

□ 

Remark 5.7. We could define a system E-HAj!;'g*j by adding primitive predicates nsf^ 
("nonstandard") to E-HA"j* for each finite type cr, along with axioms 

Va;''(nst(a;) ^ -.st(.T)). 

If we then extend the Dgt -interpretation by 

{nst^x^)f^' -VVy?^^^:), 

we get an analogue of Theorem 15.51 since (nst(a;) -ist(a;))^''' is provably equivalent 
to 

^styyst^ (Vy e Y[z]{y ^ x) x ^ z) 
and (-ist(a;) — > nst(x))"'^^* to 

3''Z\/'''y (Vz' G Z[y]x ^ z' ^ y x) , 
so that we can take Y[z] := z and Z[y] := {(y)) respectively . 

5.2 The characteristic principles of the nonstandard functional 
interpretation 

In this section wc will prove that the characteristic principles of the nonstandard func- 
tional interpretation are I, NCR, HAC, HlPv^t, and HGMP''*. For notational simplicity 
we will let 

H := E-HA^t*+ I + NCR + HAC + HlPyet + HGMP"*. 

Theorem 5.8 (Characterization theorem for the nonstandard functional interpreta- 
tion) . 

1. For any formula $ in the language of E-HA^^* we have 

H h $ ^ $o=^t 

2. For any formula "i! in the language of E-HA"j* we have: If for all $ in £(E-HA"j*) 
(with <I>-^=' = 3^^x\/^^y (pu^^ isLiU)) the implication 

H + f h $ =^ there are closed terms t £ T* s.t. E-HA"^ h Wyipn,, (Ly) (4) 

holds, then H h 
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Proof. 

1. We will prove item 1 by induction on the logieal structure of $. 

(a) As induction start we note that for internal atomic (p we obviously have 

H h </? ip^"^ , that 

H h stiu") B^'x^'u e X 
follows by taking a; :— (u), and that 

H h 3"V*Mex^st(w'") 

is Lemma [2. Ill 

(b) For the induction step involving $, ^I* we will use that (see 1.6.17 in via 
appropriate embeddings of tuples of types in a suitable common higher type 
and tuple coding of functionals with inverses (all given by terms in T*) there 
are (p{x^ y), ip{u^ v) such that 



and 

E-HA^t* h ^^"^ <^ 3^*wV''*vV(u,«), 

and such that (p{x, y) and v) are provably upwards closed in x and u 
respectively. 

i. For A we must consider 

3'*xV^'y <^(x, y) A 3''^uY^v'ip{u,v) o 3''^x,u\/''^y,v {tp{x,y) A 'ip{u,v)), 

which follows by intuitionistic logic. (We can assume that u, v do not 
appear in tp, and that x^y do not appear in -0.) 

ii. For V we note that 

3''^x'i''^yip{x,y) V 3''*'uV''*w ?A(u, w) ^ 3''^x,ui''^y,v [(p{x,y) V 'il^{u,v)) 

follows from LLPO^', which by Proposition 13.41 follows from I. 

iii. For implication we use that ^{u^v) is upwards closed in u to conclude 

3'^*2;V"V ip{x, y) 3"*uV"*u ip{u, v) ^ 
V^'x (V^*y ip{x, y) ^ 3^'mV"'w V(u, v)) 
V^'cca^^u (V"V p{x, y) Y\ V(u, « 

3"W*xV"*w3"V (Vi e y V3(a;,i) ^ V(f/(a;),t' 
gstjj^ yV"*x, ?; (Vi e y(.T, v) ip{x, i) ^piU{x),v 
3'^*[/,yV"*x,w (Vi e y[a;,u]^(x,i) -> V(f/[a;],w) 

iv. For V we use NCR and that (p(x, y, z) is upwards closed in x to get 



HGMP"' 



HAC 



HAC+ coding X,V into 



V. For 3 we use I: 



3z3''^xW''^ycp{x,y,z) o 

3''*x32;V''*y i^(a;, y, z) A 
B^'xY'yBzVy' eyp{x,y',z). 
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vi. For we use HAC and that ip(x,y, z) is upwards closed in x: 

\f'z3''xy''y^{x,y,z) 3''XY'z,y ^{X{z),y, z) O 3''xy''z,y ip{X[z],y, z) 

vii. For 3^^ we will again use I: 

3'^z{3'^xy''yip{x,y,z)) <-> 
3"*z3z' e z(3"'xV"'y(y9(a;,y,z')) ^ 
3^*2 3z' e z V"*y (/^(a;, y, z') o 
3''*z3'''.tV"*?;3z' e z^y' e y ^{x,y' , z'). 

2. Assume that 4* is a formula of /^(E-HA"^*) such that implication (|4]) holds, and let 
vj/Dat ^ B^^xV*?/ V-Dst in^y)- Then because of item 1 we have 

H + * h * 
3teT* s.t. E-HA"* hVy7/'B,,(t,y) 
3t er* s.t. E-HA^;hV£Vi3..a,y) 
3ter* s.t. E-HA^: hy^'yijn.At,y) 
E-HA^;h3^'£V^'|/7^z5^, fey) 
H 1- 3^feV''tyi^i,^, {x,y) 
H h 

□ 

Theorem 15.51 allows us to extract a finite sequence of candidates for the existential 
quantifier in formulas of the form V"^'a; 3^*y y), in the following sense: 

Theorem 5.9 (Main theorem on program extraction by the Dgt -interpretation) . Let 
\f^*'x3^*'y ip{x,y) be a sentence o/ E-HA^^* with ip{x,y) an internal formula, and let Aint 
he a set of internal sentences. If 

E-HA^t*+ I + NCR + HAC + HGMP"* + HlPyet + Aipt h V^'a; 3''*y (^(x, y), 

then from the proof we can extract a closed term t in T* such that 

E-HA"* + Aipt K Va; 3y e t{x) Lp{x, y). 

Proof. Since 

(V'''a;3"*y (p(a;,y))^=' = 3''^YY^x3y e Y[x] ip{x,y) 

it follows from the soundness theorem of the Dst -interpretation that there is a closed 
term s such that 

E-HA'^* + A;,, h\^x3y e s[x]ip{x,y), 
and so we can let t Xx . six]. □ 
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Remark 5.10. Probably it is clear by now that our functional interpretation has some 
striking similarities with the bounded functional interpretation due to Ferreira and Oliva 
|12] . Also there the authors work with two types of quantifiers, get an interpretation 
whose matrix is upwards closed in the first component (albeit with respect to a different 
ordering), interpret implications a la Diller-Nahm and have some similar looking char- 
acteristic principles, like a monotone axiom of choice. But, still, the precise relationship 
is not entirely clear to us, because we are now comparing the external quantifiers with 
the unbounded quantifiers in the bounded functional interpretation, which is not very 
natural. These issues deserve to be further investigated. 

5.3 Discussion 

It follows from the soundness of the Dst -interpretation (Theorem 15. 5|) that it can be 
used to eliminate nonstandard principles, like overspill, realization and idealization, 
from proofs. It also allows one to eliminate underspill, since we have the following result 
(recall that R is the realization principle from Section 4.1): 

Proposition 5.11. We have 

E-HA^t*-|- R+ HGMP"* f- US, 

and therefore the underspill principle US is eliminated by the Dgt -interpretation. 

Proof. We reason in E-HA"t*+ R + HGMP"'. Assume Va;'^(-.st(a;) (p{x)). Our aim is 
to find a standard x such that f{x) holds. 

Va;°'(-ist(a;) —5- ip{x)) is equivalent to ^x'^ {y^^y'^ {y ^ x) — > ip{x)), which, using 
HGMP''*, we can rewrite as 

Vx'^ 3"V* (Vy' e y{y' ^ x) ^ (^(a;)) . 

It now follows from R that there is a standard y of type a* such that 

\/x''{\/y' &y{y' ^x)^^{x)). 

So if we choose a; to be a standard element of type a different from all y' G y, then Lp(x) 
will hold. □ 

We also have: 

Proposition 5.12. The system H := E-HA^j*+ I + NCR + HAC + HGMP'* + HlPy^t is 
closed under both transfer rules, TRy and TRg. 

Proof. If H h V^'x (/3(.t), then E-HA'^* h \/xif{x) by soundness of the Dgt -interpretation. 
Since E-HA'^* is a subsystem of H, it follows that H h \/xif{x). This shows that H is 
closed under TRy. 

If H h 3xLp{x)^ then E-HA"^* h 3x<p(a;) by conscrvativity of H over E-HA'^*. Since 
E-HA"^* has the existence property (the usual argument for the existence property of 
E-HA'^, as in [25l Corollary 5.24], for instance, carries over to E-HA"*), it follows that 
there is a term t in T* such that E-HA"* h </j(t). Again, because E-HA'^* is a subsystem 
of H, we have H h ip{t) as well, and since all terms from T* are provably standard in H, 
we have H h 3^^xif{x). This shows that H is closed under TR3 as well. □ 

Therefore our functional interpretation Dst meets all the benchmarks that we dis- 
cussed in Section 4. 

6 The system E-PA^^*and negative translation 

By combining the functional interpretation from the previous section with negative 
translation we can obtain conservation and term extraction results for classical systems 
as well. We will work out the details in this and the next section. 
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First, we need to set up a suitable classical system E-PA"j*. It will be an extension 
of E-PA"*, which is E-HA'^* with the law of excluded middle added for all formulas. 
When working with classical systems, we will often take the logical connectives -i,V,V 
as primitive and regard the others as defined. In a similar spirit, the language of E-PA^j* 
will be that of E-PA"^* extended just with unary predicates sf^ for every type cr G 2*; 
the external quantifiers V', 3*^* are regarded as abbreviations: 

V"*x$(a;) :ee Vx-( st(x) $(a;) ), 
3''*a;$(x) := 3a;( st(x) A ). 

Definition 6.1 (E-PA^j*). The system E-PA"t*is 

E-PA^t* := E-PA"* +T*t + lA"* 

where 

• Tsl consists of: 

1. the schema st(.T) A a: = y — !> st(y), 

2. a schema providing for each closed term t in T* the axiom st(i), 

3. the schema st(/) A st(x) st(/x). 

• lA*^* is the external induction axiom: 

lA"' : ($(0) A V"*n''($(n) ^ $(71 + 1))) ^ V''*?i"$(n). 

Again we warn the reader that the induction axiom from E-PA"* 

(V?(0) A \fn°{ip{n) ip{n + 1))) ^ Vn°Lp{n) 

is supposed to apply to internal formulas ip only. 

As for E-HA"j*, we have: 

Proposition 6.2. // a formula $ is provable in E-PA"j* then its internalization is 
provable in E-PA"*. Hence E-PA^j* is a conservative extension 0/ E-PA"^* and E-PA'^. 

We will now show how negative translation provides an interpretation of E-PA"j* in 
E-IHA^^.*. Various negative translations exist, with the one due to Godcl and Gentzen 
being the most well-known. Here, we work with two variants, the first of which is due 
to Kuroda [331. 



Definition 6.3 (Kuroda's negative translation for E-PA^^.*). For an arbitrary formula <& 
in the language of E-PA^^., we define its Kuroda negative translation in E-HA^j* as 



:= --<&Ku, 

where $ku is defined inductively on the structure of $ as follows: 

$Kl — $ for atomic formulas $, 

(V2;$(a:))^^ := Vx — $Ku(2:)- 
Theorem 6.4. E-PA^^* h $ o <I''<^ and if E-PA^t*+ A h $ then E-HA^j*+ A'^'' h $ 



Ku 
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Proof. It is clear that, classically, <J>, <J>ku and $ are all equivalent. The second 
statement is proved by induction on the proof of E-PA^t*+ A h $. For the cases of the 
axioms and rules of classical logic and E-PA"*, see, for instance, [551 Proposition 10.3]. 
As the Kuroda negative translation of every instance of 7^* or lA*'* is provable in E-HA^j* 
using the same instance of 7^^ or lA**' , the statement is proved. □ 

It will turn out to be convenient to introduce a second negative translation, extracted 
from the work of Krivine by Streicher and Reus (see [311 271 US])- This translation will 
interpret E-PA"t* into E-HAJ:;*^ (see Remark [57]) . 

Definition 6.5 (Krivine's negative translation for E-PA"j*). For an arbitrary formula $ 
in the language of E-PA"^* we define its Krivine negative translation in E-HAJ^g*^ as 

where 3>Kr is defined inductively on the structure of $ as follows 

(ySKr '■= for an internal atomic formula 

st(x)Kr ~ nst(a;), 

($V*)^^ :=$Kr A*Kr, 

(Va;$(x))^^ :=3.T$Kr(a:). 



Theorem 6.6. For every formula $ in the language of E-PA"^.* we have: 

1. e-ha;:;* h ^ ^'^r 

2. If E-PA^t*+ A h then E-HA^* + A^<^ h 

Proof. Item 1 is easily proved by induction on the structure of $. Item 2 follows from 
item 1 and Theorem 16.41 □ 



7 A functional interpretation for E-PA^^* 

We will now combine negative translation and our functional interpretation D^t to obtain 
a functional interpretation of the classical system E-PA"^*. 



7.1 The interpretation 

Definition 7.1. (^st -interpretation for E-PA^^*.) To each formula $(a) with free vari- 
ables a in the language of E-PA^^* we associate its 5st -interpretation 

(a) ■.= y''x3\>ps{x,y,a), 

where Lps is an internal formula. Moreover, x_ and y are tuples of variables whose length 
and types depend only on the logical structure of <&. The interpretation of the formula 
is defined inductively on its structure. If 

$^='(a) :=V"*x3"'y ips{x,y,a) and (6) :=V"'ii3"'w i}s{u,v,b), 

then 

(i) (y5'^=' := Lp for atomic internal </5(a), 

(ii) (st(z))'^" :=3^'a;(z = x), 
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(iii) ■■='^^^Y3^^xVyeY[x]^ips{x,y,a), 

(iv) (^V^-)^- := V^'^, t; ((^s fey, a) V^s 

(v) (izip)^^^ := V''*x3''*£Vz3y' e y (^sfe y', z). 

Theorem 7.2. (Soundness of the 5st -interpretation.) Let $(a) be a formula in the 
language o/ E-PA^^* and suppose $(a)"^=' = V'^*a;3^*?/(^(a;, ?/,a). // Ajpt is a collection of 
internal formulas and 

E-PA^;+Ainth$(a), 

then one can extract from the formal proof a sequence of closed terms t in T* such that 
E-PA"* + Aint h yx3y e t{x) <^(x,y,a). 
Our proof of this theorem rehes on the following lemma: 
Lemma 7.3. Let $(a) be a formula in the language of E-PA"j* and assume 

^Sat = V*'*x3''*?/(y9(z, ?/,a) and 
($Kr)^=' = 3'''uV''ve{u,v,a). 

Then the tuples x and u have the same length and the variables they contain have the 
same types. The same applies to y and v. In addition, we have 

E-PA'^* h ^{x,y,a) ^9{x,y,a). 

Proof. The proof is by induction on the structure of $. 

(i) If <f> = tp, an internal and atomic formula, then = tp and 9 = -ii/j, so 
E-PA"* hip^ -n9. 

(ii) If $ = st(z), then (p = y = z and 6* = y 7^ z, so E-PA"* \- ip ^ ^9. 

(iii) If $ = with ($')^=' = V"*£3"'y V3'(£,y,a) and ($Kr)'°=' = 3"*wV"' w 61' (u, w , a) , 
then (fi = \/y^ € Y[x] ^</j'(x,y') and 9 = ^Vi G Y[x] 9'{x,i). Since 
E-PA"* hip' ^ -•9' by induction hypothesis, also E-PA"* h ip ^9. 

(iv) If <I> = $0 V <I>i with 

=V^fe3^*y(/.,(x,y,a) 

and 

(($,)Kr)''=' =^^'u^^'v9,{u,v,a), 

then = (^0 V </Ji and 9 = 9q A 9i. Since E-PA"* \- ipi ^ -^9i by induction 
hypothesis, also E-PA"* \- ip ^ ^9. 

(v) If $ = Vz $' with 

($')S.t =V^V3^'y^'(£,y,z,a) 

and 

($'k,)^=' = 3'^*wV"*w6l'(M,w,z,a), 

then = Vz3y' £ y^' {3L,y' , z,a} and 6* = 3z\/y' G y 9'{x,y\z,a). Since 
E-PA"* h (/j' o "6*' by Induction hypothesis, also E-PA"* h"V ^ 

□ 

Remark 7.4. This lemma is the reason why we introduced the system E-HAj^g*^ in 
Remark 15.71 it would fail if we would let the Krivine negative translation land directly 
in E-HA"j* with st(z)Kr = ^st(z). As it is, this lemma yields a quick proof of the 
soundness of the Sst -interpretation. 
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Proof. (Of the soundness of the iSst -interpretation, Theorem 17.20 Let $(a) be a 
formula in the language of E-PA"^* and let tp and be such that 

and E-PA"* h (^9 o ^6*, as in Lemma [731 

Now, suppose that Ajpt is a set of internal formulas and $(a) is a formula prov- 
able in E-PA^j* from Aint- We first apply soundness of the Krivine negative translation 
f Theorem I6.6P to see that 

E-HA-* + Ar,^ h 
where = -<I>Kr- So if (<I>Kr)'°=' = 3''*^V"'y 6l(x, y, a), then 

($Kr)D,t = B'^tyv'^t^By e i:[sc]^6l(x, y, a). 

It follows from the soundness theorem for Dst fTheorem lS.Sp and Remark 15.71 that there 
is a sequence of closed terms s from T* such that 

E-HA"'* + A.[^^^ h V^By e s[x]^6l(x, y, a). 
Since E-PA"'* h IS^f^^ o Aipt and E-PA"* h <^ o ^6* we have 

E-PA"* + Aipt I- VxBy e t(x) p{x,y,a), 
with t = Ax.s[a;]. □ 



7.2 Characteristic principles 

The characteristic principles of our functional interpretation for classical arithmetic are 
idealization I (or, cquivalently, R: see Section 4.1) and HACjnt 

V^'ajB'^'y tp{x, y) -> B'^^FWBy G F{x) ^(x, y), 

which is the choice scheme HAC restricted to internal formulas. To sec this, note first of 
all that we have: 

Proposition 7.5. For any formula <i> in the language of E-PA^j* one has: 

E-PA^t*+ I + HACipt K $ ^ . 

Proof. An easy proof by induction on the structure of $, using HACint for the case of 
negation and I (or rather R) in the case of internal universal quantification. □ 

For the purpose of showing that I and HACint are interpreted, it will be convenient 
to consider the "hybrid" system E-HAj!;'^*^. -I- LEMint, where LEMint is the law of excluded 
middle for internal formulas. For this hybrid system we have the following easy lemma, 
whose proof we omit: 

Lemma 7.6. We have: 

1. E-HA^g*j + LEMint 1^ 'f^" 'i'f f is o.^ internal formula in the the language of 
E-PA^t*. 

2. e-ha;;;* + LEMipt + 1 y- i"^". 

3. E-HA;;;* +LEMipt + HACint + HGMP^* y- HAC[^„^. 
This means we can strengthen Theorem 17.21 to: 
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Theorem 7.7. (Soundness of the S'st -interpretation, full version.) Let <I>(a) be a for- 
mula in the language of E-PA"^* and suppose $(a)'^'" = V'^'a; 3^*y <y9(^, y,a). // Aint is a 
collection of internal formulas and 

E-PA^;+l + HACint + Ai„th$(a), 

then one can extract from the formal proof a sequence of closed terms t in T* such that 

E-PA"* + Aint I- Vx3y e t{x) ip{x,y,a). 

Proof. The argument is a slight extension of the proof of Theorem 17.21 So, once again, 
let $(a) be a formula in the language of E-PA"j.* and if and 6 be such that 

^s,t ^ y^^xB^'^y tp{x,y,a), 

and E-PA"* h ^ as in Lemma [7.31 

This time we suppose Aint is a set of internal formulas and $(a) is a formula provable 
in E-PA"j* from I + HACjnt + Aint. We first apply soundness of the Kuroda negative 
translation fTheorem l6.4[) . which yields: 

e-ha;:;* + 1^" + HACi'^nt + Ai'^nt ^ 

Then the previous lemma implies that: 

E-HA^;* + LEMint + I + HACint + HGMP"' + A^nt ^ 

Note that E-HA;:;* h o '^>^' = ^<I>Kr and 

($Kr)D,t ^ B^^ry/'^xBy e Y[x]^0{x,y,a). 

Therefore the soundness theorem for Dgt (Theorem 15. 5p . in combination with Remark 
15. 71 and the fact that the axiom scheme LEMint is internal, implies that there is a sequence 
of closed terms s from T* such that 

E-HA"* + LEM + Af^nt ^ Vrfy e s[x]^0{x,y,a). 

Since E-PA"* h LEM, E-PA"* h A.[^^ o Aint and E-PA"* h o -6*, we have 

E-PA"* + Aint I- yx3y e t{x) (p{x,y,a) 

with t = Ax.s [x] . □ 

The following picture depicts the relation between the various interpretations we 
have established: 

E-PA^t*+ I + HACint 




Figure 1: The Shoenfield and negative Dialectica interpretations. 
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7.3 Conservation results and the transfer principle 

Theorem 17.71 immediately gives us the fohowing conservation result: 

Corollary 7.8. E-PA^t*+ I + HAC int is a conservative extension of E-PA"* and hence of 
E-PA". 

We conjecture that this result is not the best possible and that 
E-PA^t* + I + HACint + TPv is also conservative over E-PA"*. This would 
follow from: 

Conjecture 7.9. Let $(a) be a formula in the language of E-PA"(.* and suppose 
^(a)^"^ =y^'^x3^*'y (p{x,y,a). // Aint is a collection of internal formulas and 

E-PA^;+ I + HACipt + TPv + Aint h $(a), 

then 

E_pA-* + Ai,th Wx3yip{x,y,a). 

Unfortunately, one cannot prove this by showing that one can strengthen 
the hypothesis of Theorem O from E-PA^^* + I + HACint + Aint I" ^(a) to 
E-PA"j*+ I + HACint + TPv + Aint ^ 3>(a), for this strengthened version fails. To see why, 
note that the S'st -interpretation of TPv 

\/''H{y'''xip{x,t) -^Wxip{x,t)) 

is provably equivalent to 

Therefore such a strengthened version of Theorem 17. 71 would imply that for any formula 
in the language of E-PA"^* without parameters (p{x) there are terms ti, . . . ,t„ such that 

E-PA"* h /\ip{t,) yxip{x). 

i 

To refute this general statement, it suffices to consider a quantifier-free formula (p{x) 
such that \/xip{x) is true, but not provable in E-PA" (such as "x is not the Godel number 
of a proof in E-PA" of This last argument does not refute the conjecture, for the 
statement 

3y ( ip{y, t) -5- Va; ip{x, t) ) 

is a tautology and hence provable in E-PA'^*. 

Still, we expect that adding TPv to E-PA"^*+ 1 -f HACint does not destroy conservativity 
over E-PA'^*, because transfer is part of many similar nonstandard systems that have 
been shown to be conservative over classical base theories (see [H] and [Sn])- One natural 
way to attack this problem would be to try to prove Conjecture 17.91 along the lines of 
[39] . We plan to take up these issues in future work. 

8 Conclusion and plans for future work 

We hope this paper lays the groundwork for future uses of functional interpretations to 
analyse nonstandard arguments and systems. There are many directions, both theoret- 
ical and applied, in which one could further develop this research topic. We conclude 
this paper by mentioning a few possibilities which we would like to take up in future 
research. 

First of all, we would like to see if the interpretations that we have developed in 
this paper could be used to "unwind" or "proof-mine" nonstandard arguments. Non- 
standard arguments have been used in areas where proof-mining techniques have also 
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been successful, such as metric fixed point theory (for methods of nonstandard analysis 
applied to metric fixed point theory, see [U [52] ; for application of proof-mining to met- 
ric fixed point theory, see [SI HH [131 HZl HH IM] ) and ergodic theory (for a nonstandard 
proof of an ergodic theorem, see [20]; for applications of proof-mining to ergodic the- 
ory, see |3j HJ [151 HSl IMl UHl therefore this looks quite promising. For the former 
type of applications to work in full generality, one would have to extend our functional 
interpretation to include types for abstract metric spaces, as in [Tfl [^ . 

But there are also a number of theoretical questions which still need to be answered. 
Several have been mentioned already: for example, mapping the precise relationships 
between the nonstandard principles that we have introduced. Another question was 
whether E-PA"j* -|- I -|- HACint + TPy is conservative over E-PA'^*. Another question 
is whether our methods allow one to prove conservativity results over WE-HA'^ and 
WE-PA'^ as well: this will be important if one wishes to combine the results presented 
here with the proof- mining techniques from |25| . 

In addition, we would also like to understand the use of saturation principles in 
nonstandard arguments. These are of particular interest for two reasons: first, they are 
used in the construction of Loeb measures, which belong to one of the most successful 
nonstandard techniques. Secondly, for certain systems it has turned out that extending 
them with saturation principles has resulted in an increase in proof-thcorctic strength 
(see [IH1[1I]). 

The general saturation principle is 

SAT : V^'a;'" $(a;, y) -> B/*"^^ V^'x"" $(a;, f{x)). 

Whether this principle has a -interpretation within Gddel's 7"*, we do not know; but 

CSAT : V^'riO $(n, y) 3f^^ V^'n" $(n, f{n)) 

has and that seems to be sufficient for the construction of Loeb measures. Interpreting 
CSAT and SAT in the classical context using the Sst -interpretation is probably quite 
difficult and it is possible that they require some form of bar recursion. We hope to be 
able to clarify this in future work. 
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